ASB-A-517377154

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-517377154.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-517377154
Aliases
  • A-517377154
  • CVE-2026-55270
Published
2026-10-01T00:00:00Z
Modified
2026-10-05T16:56:07Z
Summary
[none]
Details

In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/frameworks/opt/telephony

Package

Name
platform/frameworks/opt/telephony

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-10-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "221394791022293154273777459030637463810",
                "length":  1700
            },
            "id":  "ASB-A-517377154-290421eb",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java",
                "function":  "dialInternal"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "85564889611049434015439836351970671330",
                    "321032152181963527884525531471844641270",
                    "3432312994283051198705360490823037384",
                    "26180908986988205332850313313899922389",
                    "215467192842611058928262666195218348653",
                    "88284407523653103560900716683235967625",
                    "298661402963263501180526436452982816388",
                    "296798653215701405775789907848957976896",
                    "292903738859645515677839881079245263014"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-7663ce10",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "201191755801169938559793686686857451416",
                "length":  931
            },
            "id":  "ASB-A-517377154-92d426e8",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java",
                "function":  "dialInternal"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "277581113841276915046506624877618589123",
                    "26807683584315311557738686723874494849",
                    "180113764066743593245372552958971069287",
                    "125563055740235136696996883584854084164"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-d5bd7508",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/c2453d183ba30b1b21576231cb79e0d7d50d4103",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"
platform/frameworks/opt/telephony

Package

Name
platform/frameworks/opt/telephony

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2026-10-01

Affected versions

Other
15

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "6305359641223191727483443275289539815",
                "length":  822
            },
            "id":  "ASB-A-517377154-5924e594",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java",
                "function":  "dialInternal"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "276486398894243870858939285016085180769",
                    "331130644673552391344038389965615968271",
                    "196359260725455957277826842540430308842",
                    "228067325901179876767365283075649691739"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-6daeb922",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "251213840187113905346480696010844682837",
                "length":  1304
            },
            "id":  "ASB-A-517377154-7d810d39",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java",
                "function":  "dialInternal"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "149153288427063021861143638119183404026",
                    "100665003626303544326226369782043996662",
                    "60715967235166955707373939140397294650",
                    "336219546894114884852735354772127773921"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-b48d2834",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/ff909138c57a24664354f10449b3585cbfa4291c",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"
platform/frameworks/opt/telephony

Package

Name
platform/frameworks/opt/telephony

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-10-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "174077472406464759824351320962334433947",
                    "325562207689985291227948377045572501240",
                    "134326709048462993827154183361924573471",
                    "304998092329951519773749479357793624221",
                    "338009389495854147057311071991689450413",
                    "110355204068176469511525399724419046930",
                    "161711783838440220482376833713856559904",
                    "90946821917742786583255147253775975404"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-1abd6d05",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "317438603624160635743171545201367024942",
                "length":  938
            },
            "id":  "ASB-A-517377154-700b08c2",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java",
                "function":  "dialInternal"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "156032670633742517260113234718591625572",
                    "171455528062073778619381724172853253549",
                    "134326709048462993827154183361924573471",
                    "304998092329951519773749479357793624221",
                    "338009389495854147057311071991689450413",
                    "110355204068176469511525399724419046930",
                    "161711783838440220482376833713856559904",
                    "90946821917742786583255147253775975404"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-864916d6",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "40809998033970267222727927159235444304",
                "length":  1634
            },
            "id":  "ASB-A-517377154-e0919ec2",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/15060a99e3d70a5d4f8a3ea88fe70b675750099b",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java",
                "function":  "dialInternal"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"
platform/frameworks/opt/telephony

Package

Name
platform/frameworks/opt/telephony

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-10-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "237927818888720316944931895446297837050",
                    "59836574792446009165025135316108749894",
                    "128839134679662729639640806331666225701",
                    "337071243829700196987641404901216088952"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-329f220f",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "285767272394866841301906938934138203699",
                "length":  1537
            },
            "id":  "ASB-A-517377154-46ebd872",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java",
                "function":  "dialInternal"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "6481862458218090228218788075869645289",
                    "115463448771535689218673312633010310118",
                    "128839134679662729639640806331666225701",
                    "27394729640458959225443737895051313693"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-77e7610a",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "72497289640835833960216901968607590254",
                "length":  774
            },
            "id":  "ASB-A-517377154-b3f1c5a5",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/435d5e999f41becc4e2842da6c77a5df7688133b",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java",
                "function":  "dialInternal"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"
platform/frameworks/opt/telephony

Package

Name
platform/frameworks/opt/telephony

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-10-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "88284407523653103560900716683235967625",
                    "298661402963263501180526436452982816388",
                    "296798653215701405775789907848957976896",
                    "292903738859645515677839881079245263014"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-4a6f2b8d",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "221394791022293154273777459030637463810",
                "length":  1700
            },
            "id":  "ASB-A-517377154-5fd5c6ae",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java",
                "function":  "dialInternal"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "201191755801169938559793686686857451416",
                "length":  931
            },
            "id":  "ASB-A-517377154-ad12e3f6",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java",
                "function":  "dialInternal"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "277581113841276915046506624877618589123",
                    "26807683584315311557738686723874494849",
                    "180113764066743593245372552958971069287",
                    "125563055740235136696996883584854084164"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-d6fda682",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/b41275b0c54708ba582889839b8fa15cd1fd965a",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"
platform/frameworks/opt/telephony

Package

Name
platform/frameworks/opt/telephony

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2026-10-01

Affected versions

Other
14

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de"
    ],
    "severity":  "High",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "251213840187113905346480696010844682837",
                "length":  1304
            },
            "id":  "ASB-A-517377154-33711728",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java",
                "function":  "dialInternal"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "276486398894243870858939285016085180769",
                    "331130644673552391344038389965615968271",
                    "196359260725455957277826842540430308842",
                    "228067325901179876767365283075649691739"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-526af996",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "149153288427063021861143638119183404026",
                    "100665003626303544326226369782043996662",
                    "60715967235166955707373939140397294650",
                    "336219546894114884852735354772127773921"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-517377154-7117f3c9",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/imsphone/ImsPhone.java"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "6305359641223191727483443275289539815",
                "length":  822
            },
            "id":  "ASB-A-517377154-a01b9dad",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/frameworks/opt/telephony/+/9fa4c4526585c82838d767f212b75addc46d62de",
            "target":  {
                "file":  "src/java/com/android/internal/telephony/GsmCdmaPhone.java",
                "function":  "dialInternal"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-517377154.json"